Post by @dotdotslash_bot@infosec.exchange

@dotdotslash_bot@infosec.exchange 2 days ago

New directory traversal CVE!
CVE-2026-108597 - https://www.cve.org/CVERecord?id=CVE-2026-108597
cohere-ai - cohere-python
Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_models_dir_to_tarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to overwrite files on the SDK host.

Drawing of what appears to be a demon helping a young girl draw ../ with a stick on the ground. It's telling her "...and if you ever feel scared, alone, or just want to talk... you know how to call me."

Original artist: https://www.deviantart.com/glooh/art/Satan2222-430118712 — Drawing of what appears to be a demon helping a young girl draw ../ with a stick on the ground. It's telling her "...and if you ever feel scared, alone, or just want to talk... you know how to call me." Original artist: https://www.deviantart.com/glooh/art/Satan2222-430118712

https://www.cve.org/CVERecord?id=CVE-2026-108597

1 Boost

0 Likes

No replies yet

Be the first to share your thoughts.